Cara Konfigurasi Debian Server di VPS untuk Pemula (SysAdmin)

# Koneksi menggunakan password
ssh root@your-server-ip

# Atau menggunakan SSH key
ssh -i /path/to/private-key root@your-server-ip

# Dengan port custom
ssh -p 2222 root@your-server-ip

root@debian-server:~#

# Update package list
apt update

# Upgrade semua package yang terinstall
apt upgrade -y

# Upgrade distribution (opsional)
apt dist-upgrade -y

# Clean up
apt autoremove -y
apt autoclean

# Cek versi Debian
cat /etc/debian_version

# Informasi system lengkap
uname -a

# Informasi OS
lsb_release -a

# Buat user baru
adduser username

# Tambahkan ke grup sudo
usermod -aG sudo username

# Cek grup user
groups username

# Switch ke user baru
su - username

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

nano /etc/ssh/sshd_config

# Ubah port default (opsional tapi direkomendasikan)
Port 2222

# Disable root login
PermitRootLogin no

# Hanya izinkan user tertentu
AllowUsers username

# Disable password authentication (jika menggunakan SSH key)
PasswordAuthentication no

# Disable empty passwords
PermitEmptyPasswords no

# Limit login attempts
MaxAuthTries 3

# Connection timeout
ClientAliveInterval 300
ClientAliveCountMax 2

systemctl restart sshd
systemctl status sshd

# Generate SSH key pair
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

# Copy public key ke server
ssh-copy-id -p 2222 username@your-server-ip

# Cek authorized_keys
cat ~/.ssh/authorized_keys

# Set permission yang benar
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Install UFW (biasanya sudah terinstall)
apt install ufw -y

# Reset ke default
ufw --force reset

# Default policies
ufw default deny incoming
ufw default allow outgoing

# Allow SSH (sesuaikan dengan port Anda)
ufw allow 2222/tcp

# Allow HTTP dan HTTPS
ufw allow 80/tcp
ufw allow 443/tcp

# Enable firewall
ufw enable

# Cek status
ufw status verbose

# Allow specific IP
ufw allow from 192.168.1.100

# Allow port range
ufw allow 8000:8010/tcp

# Allow specific service
ufw allow mysql

# Delete rule
ufw delete allow 80/tcp

# Build essentials
apt install build-essential -y

# Version control
apt install git -y

# Text editors
apt install vim nano -y

# Network tools
apt install curl wget net-tools -y

# System monitoring
apt install htop iotop -y

# Archive tools
apt install zip unzip -y

# Install Nginx
apt install nginx -y

# Start dan enable
systemctl start nginx
systemctl enable nginx

# Cek status
systemctl status nginx

# Test konfigurasi
nginx -t

# Install MariaDB
apt install mariadb-server -y

# Secure installation
mysql_secure_installation

# Start dan enable
systemctl start mariadb
systemctl enable mariadb

# Install PHP dan extensions
apt install php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip -y

# Cek versi PHP
php --version

# Start PHP-FPM
systemctl start php8.2-fpm
systemctl enable php8.2-fpm

# Buat direktori website
mkdir -p /var/www/example.com/html

# Set ownership
chown -R www-data:www-data /var/www/example.com

# Buat file index
echo "<h1>Welcome to Example.com</h1>" > /var/www/example.com/html/index.html

# Buat konfigurasi site
nano /etc/nginx/sites-available/example.com

server {
    listen 80;
    listen [::]:80;
    
    root /var/www/example.com/html;
    index index.html index.htm index.php;
    
    server_name example.com www.example.com;
    
    location / {
        try_files $uri $uri/ =404;
    }
    
    # PHP processing
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
    }
    
    # Deny access to .htaccess files
    location ~ /\.ht {
        deny all;
    }
}

# Enable site
ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

# Test konfigurasi
nginx -t

# Reload Nginx
systemctl reload nginx

# Install snapd
apt install snapd -y

# Install certbot
snap install --classic certbot

# Create symlink
ln -s /snap/bin/certbot /usr/bin/certbot

# Generate certificate
certbot --nginx -d example.com -d www.example.com

# Test auto-renewal
certbot renew --dry-run

# Login ke MySQL
mysql -u root -p

# Buat database
CREATE DATABASE myapp_db;

# Buat user
CREATE USER 'myapp_user'@'localhost' IDENTIFIED BY 'strong_password';

# Grant privileges
GRANT ALL PRIVILEGES ON myapp_db.* TO 'myapp_user'@'localhost';

# Flush privileges
FLUSH PRIVILEGES;

# Exit
EXIT;

# Backup single database
mysqldump -u root -p myapp_db > myapp_db_backup.sql

# Backup all databases
mysqldump -u root -p --all-databases > all_databases_backup.sql

# Restore database
mysql -u root -p myapp_db < myapp_db_backup.sql

# Cek penggunaan disk
df -h

# Cek penggunaan memory
free -h

# Cek proses yang berjalan
ps aux

# Monitor real-time
htop

# Cek log system
journalctl -f

# Cek log Nginx
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

# Buat script backup
nano /home/username/backup.sh

#!/bin/bash

# Variables
BACKUP_DIR="/home/username/backups"
DATE=$(date +%Y%m%d_%H%M%S)

# Create backup directory
mkdir -p $BACKUP_DIR

# Database backup
mysqldump -u root -p'your_password' --all-databases > $BACKUP_DIR/db_backup_$DATE.sql

# Website backup
tar -czf $BACKUP_DIR/website_backup_$DATE.tar.gz /var/www/

# Keep only last 7 days
find $BACKUP_DIR -name "*.sql" -mtime +7 -delete
find $BACKUP_DIR -name "*.tar.gz" -mtime +7 -delete

echo "Backup completed: $DATE"

# Edit crontab
crontab -e

# Backup harian jam 2 pagi
0 2 * * * /home/username/backup.sh >> /home/username/backup.log 2>&1

# Update system mingguan
0 3 * * 0 apt update && apt upgrade -y

# Install fail2ban
apt install fail2ban -y

# Copy konfigurasi
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit konfigurasi
nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 2222
logpath = /var/log/auth.log

[nginx-http-auth]
enabled = true

systemctl start fail2ban
systemctl enable fail2ban
systemctl status fail2ban

# Disable unused services
systemctl disable bluetooth
systemctl disable cups

# Set timezone
timedatectl set-timezone Asia/Jakarta

# Configure automatic updates
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

# Edit nginx.conf
nano /etc/nginx/nginx.conf

worker_processes auto;
worker_connections 1024;

# Gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;

# Client settings
client_max_body_size 64M;
client_body_timeout 12;
client_header_timeout 12;
keepalive_timeout 15;
send_timeout 10;

# Edit MySQL config
nano /etc/mysql/mariadb.conf.d/50-server.cnf

[mysqld]
innodb_buffer_pool_size = 256M
innodb_log_file_size = 64M
query_cache_size = 32M
query_cache_limit = 2M
max_connections = 100

# Restart services
systemctl restart nginx
systemctl restart mariadb
systemctl restart php8.2-fpm

# Check service status
systemctl status service_name

# View service logs
journalctl -u service_name -f

# Fix web directory permissions
chown -R www-data:www-data /var/www/
chmod -R 755 /var/www/

# Fix SSH permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Check open ports
netstat -tulpn

# Test connectivity
ping google.com
curl -I http://your-domain.com

# DNS lookup
nslookup your-domain.com

# Backup sebelum perubahan besar
cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.backup.$(date +%Y%m%d)

# Track konfigurasi dengan git
cd /etc
git init
git add nginx/ mysql/
git commit -m "Initial server configuration"

# Setup monitoring script
nano /home/username/monitor.sh

#!/bin/bash
echo "=== System Status $(date) ==="
echo "CPU Usage:"
top -bn1 | grep "Cpu(s)" | awk '{print $2}' | cut -d'%' -f1

echo "Memory Usage:"
free -h

echo "Disk Usage:"
df -h /

echo "Active Connections:"
netstat -an | grep :80 | wc -l